Validate DNSSEC chain of trust for a domain. Checks DS records, RRSIG signatures, NSEC/NSEC3, and trust anchor linkage.